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Address Resolution Protocol (arp) 

The address resolution protocol (arp) is a protocol used by the IntemetProtoeplOOP) [ RFC826] , 
specifically IPv4, to map IP n etwork ad dresses to the hardware addresses used by a data link protocol. 
The protocol operates below the network layer as a part of the interface between the OSI network and 
OSI link layer. It is used when IPv 4 is used overjJthernet, 

The terra address resolution refers to the process of finding an address of a computer in a network. The 
address is "resolved" using a protocol in which a piece of information is sent by a client process 
executing on the local computer to a server process executing on a remote computer. The information 
receivedby the server allows the server to uniquely identify the network system for which the address 
was required and therefore to provide the required address. The address resolution procedure is 
completed when the client receives a response from the server containing the required address. 

An Ethernet network uses two hardware addresses which identify the source and destination of each 
frame sent by the Ethernet. The destination address (all l's) may also identify a broadcast packet (to be 
sent to all connected computers). The hardware address is also known as the Medium Access C ontrol 
(MAC) a ddress , in reference to the standards which define Ether net. Each computer net work interface 
card is allocated a globally unique 6 byte link address when the factory manufactures the card (stored in 
a PROM). This is the normal link source address used by an interface. A computer sends all packets 
which it creates with its own hardware source link address, and receives all packets which match the 
same hardware address in the destination field or one (or more) pre-selected bi-oadcast/multicast 
addresses. 

The Ethernet address is a link layer address and is dependent on the interface card which, is used. IP 
operates at the network layer and is not concerned with the link addr esses of individual nodes which are 
to be used/The address resolution protocol (arp) is therefore used to translate between the two types of 
address. The arp client and server processes operate on all computers using I P over E thernet. Hie 
processes are normally implemented as part of the software driver that drives the network interface card. 

There are four types of arp messages that may be sent by the arp protocol. These are identified by four 
values in the "operation" field of an arp message. The types of message arc: 



1. ARP request 

2. ARP reply 

3. RARP request 

4. RARP reply 

The format of an arp message is shown below: 



n B IS 10 31 


Hardware Type 


Protocol Type 


HUEN FLEN 


Ops-atinn 


Sender HA (octets 0-3) 


Sencfer HA (octets 4-5) 


9endar IP (octets 0-1) 


Sen da* !P (octets 2-3) 


Targat HA (octets 0-1) 


Target HA 


[octets 2-5) 


Targ3i !P (betels 03) 



Format of an arp message used to resolve the remote MACJ^rdyvare^dressJHA) 
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Address Resolution Protocol (arp) 



To reduce the number of address resolution requests, a client normally caches resolved addresses for a 
(short) period of time. The arp cache is of a finite size, and would become full of incomplete and 
obsolete entries for computers that are not in use if it was allowed to grow without check. The arp cache 
is therefore periodically flushed of all entries. This deletes unused entries and frees space in the cache. It 
also removes any unsuccessful attempts to contact computers which are not currently running. 

Example of use of the Address Resolution Protocol (arp) 

The figure below shows the use of arp when a computer tries to contact a remote computer on the same 
LAN (known as "sysa") using the "pin g" progra m. It is assumed that no previous IP datagrams have 
been received form this computer, and therefore arp must first be used to identify the MAC address of 
the remote computer. 



The arp r eq uest mes sage ("who is X -X.X.X tell Y.Y.Y.Y", where X.X.X.X and Y.Y.Y.Y are IP 
addresses) is sent using the Ethernet bro adcast address, and an Ethernet protocol type of value 0x806. 
Since it is broadcast, it is received by all systems in the same collision domain (LAN). Thi s is ensures 
that is the target of the query is connected to the network, it will receive a copy of the query. Only this 
system responds. The other systems discard the packet silently. 

The target system forms an arp response ("X.X.X.X is hh:hh:hh:hh:hh:hh", where hh:hh:hh:hh:hh:hh is 
the Etherne t so urce add ress of the computer with the IP address of XJC.X.X). This packet is umcast to 
the address of the computer sending the query (in this case Y.Y.Y.Y). Since the original request also 
included the hardware address (Eth^nel sourceMdress) of the requesting computer, this is already 
known, and doesn't require another arp message to find this out. 



Ether Type =DxB0B 
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